Promoting Awareness

Issues of Public Concern

Precautionary measures during the SARS outbreak

The SARS outbreak in 2003 had caused serious health problem and considerable concerns in the community over the state of hygiene in the territory. As SARS was a contagious disease that occurred worldwide, the government had proposed a number of precautionary measures that served to detect and control the spread of SARS. These measures included a response to the community's request to release details of where SARS cases had occurred, a proposal by Team Clean to install CCTV cameras at environmental black spots to monitor the hygiene condition of the areas and a requirement for passengers traveling to Hong Kong to submit a "Health Declaration Form".

These measures attracted considerable discussions within the community. Different opinions were held on whether the health authority should disclose dwelling places of confirmed SARS patients. Some opined that the disclosure would cause unnecessary distress to the SARS victims and intrude their privacy. Others viewed the disclosure a commitment to respect the community's rights to know. The Team Clean proposal sparked privacy fears that Hong Kong might become a "surveillance prone" society as the CCTV cameras could potentially be used to maintain surveillance on individuals.

These were valid privacy concerns. On the other hand, the government had a general duty of care to help safeguard and maintain public health and hygiene. In response to the matters, the PCPD accepted that under the very unusual circumstances, special measures had to be taken to respond to health-threatening events such as those leading to the SARS outbreak. However, these measures need to strike a proper balance between the public interests and the privacy rights of the individuals concerned. This would require an implementation process that is fair and transparent and a commitment to periodically review their effectiveness after implementation.

In connection with the proposed measures, the PCPD brought to the attention of the relevant authorities the following matters.

	The disclosure of patients¡¦ information should serve a well-intended purpose in the public interest and it should be restricted to only those information that were essential to serve that purpose. The identity of the individuals concerned should not be disclosed.
	CCTV monitoring should be carried out to the extent necessary to deal with the legitimate reasons for which the monitoring is undertaken. For example, CCTV monitoring should be limited to restricted locations where there are persistent healththreatening hazard or hygiene problems. Local community groups should also be consulted on the locations of the CCTV cameras.
	Surveillance on individuals should be kept to the absolute minimum.
	In the interest of maintaining transparency, clear signs/ notices should be prominently displayed at the perimeter of the monitoring areas so that the public are notified that they are entering a zone that is covered by CCTV monitoring.

Impact of new US anti-terrorist measures

To enhance protection against terrorist attacks, the US government plans to require foreign airlines to make available passenger name records to the US Customs Service so that background checks may be conducted in advance to identify passengers requiring additional security attention when they undergo boarding procedure. It is understood that a new Computer-Assisted Passenger Pre-screening System ("CAPPS") is being developed for the purpose and intends to apply first to passengers on flights originating in the US, and is ultimately expected to cover also passengers on flights to the US originating in other countries.

The PCPD was invited to assess the above measures, upon their implementation, on the adequacy of privacy protection on personal data concerning Hong Kong people visiting the US. Given its international application, the PCPD is of the view that any impact the new measures may have on personal data privacy warrants a global approach and the responses from countries or regions affected are therefore relevant for consideration.

Although section 33 of the PD(P)O is not yet operative restricting transfer of personal data to a place outside Hong Kong unless certain conditions are met, airlines or travel agents who collect passenger data in Hong Kong are still required to comply with the general requirements of the data protection principles in relation to "notification" and "limitation on use". In view of the new requirement, it would be prudent for airlines or travel agents to give sufficient notification to passengers regarding the disclosure arrangement. In respect of the data transfer, they should also take reasonable precautions to ensure that the data will not be processed or used by the receiving party in any manner inconsistent with the data protection principles.

New rules on preventive measures to combat money laundering

In January 2004, the Estate Agents Authority issued a Practice Circular on Preventive Measures on Money Laundering. Estate agency practitioners were asked to retain the estate agency agreement or "property viewing form" or similar document securely for at least 5 years from the date of the signing of the provisional agreement for sale and purchase, to be provided to the relevant authorities as required.

The PCPD is fully cognizant about the importance of combating crime and there are exemption provisions in the PD(P)O, notably, section 58 which when properly invoked may form the legal basis for disclosing personal data in suspected cases of money laundering. However, most law-abiding citizens who have dealings with estate agency doubt whether it is reasonable to retain their personal data for such lengthy period simply for the purpose of possible reporting of crime.

The PD(P)O imposes a duty on data users to erase personal data when the purpose of their collection is spent or fulfilled. These are provided for under DPP2 and section 26 of the PD(P)O. In the case of the estate agency, the retention of personal data simply for the purpose of possible reporting of crime where no suspicious circumstances exist at time of collection will not relieve the agency from observance of DPP2 or section 26. This was brought to the attention of the Estate Agents Authority and in this connection, the PCPD recommended estate agency to implement a clear retention policy and practice on personal data they collect in relation to their dealings with customers.